The AI Economy Is DEAD. 6 Billion Images Now POISONED.

Kind: captions Language: en An AI takeover is inevitable, or at least that's what you've been told. Once you upload a photo or a voice note, it's gone forever, scraped into AI systems feeding an insatiable hunger for data. But what if that is not the full story? Right now, a digital insurgency is taking place. Traps are being laid inside the data these models depend on. Researchers have figured out how to lobotomize AI models using just a handful of modified JPEGs, and it works. So what happens when the scrapers don't just learn from the internet, but start breaking because of it? Let's say someone types a simple request into an AI model. They ask for a photorealistic dog running through the park. It's the kind of thing a confident model nails every single time. But this time, the results are different. [music] The legs don't connect properly. Extra joints appear where they shouldn't exist. The face subtly drifts into something that's from the uncanny valley. The fur loses structure and definition. It looks like something that has seen a dog a thousand times, but it doesn't actually understand what it is. [music] And that's the work of a poisoned AI model. It's not a bug. The model is still doing what it was trained to do. The problem is what it was trained on. A poisoned AI model is what happens when someone messes with the data set it learns from. They slip in manipulated or misleading examples during training, so that the model starts picking up the wrong patterns. No one [music] has to hack anything or break into the system. Artists and creators simply post their work online, like they always have. And then the scrapers arrive. These are automated bots that crawl the internet scooping up massive amounts of images, text, data, and audio from websites. They don't understand what they're gathering. [music] They just vacuum it up to build training data sets for AI models. That's where the problem starts. Mixed in with all that normal content, poisoned examples [music] get collected, too. Nothing looks wrong at the time. The trap only reveals itself later during the next training run. The team at the University of Chicago put that theory to the test. They fed [music] Stable Diffusion about 50 altered pictures of dogs, and then they put the AI model to work. Almost immediately, the images were warped. Every single one had something wrong with it. The team kept going. Once they got to around [music] 300 poisoned images, the model started producing images of a cat. The model trains on billions of images, but for [music] any single concept, say a dog, it really only relies on a few thousand of them. Corrupt a small slice and it all starts to fall apart. You don't need millions of bad files. You need less than 1% of right ones aimed at the right concept. These models aren't isolated. [music] They're powering Midjourney, DALL-E, and the image tools built into your phone. So, if one system becomes corrupted, the effects don't stay contained. They spread. It's the opening shot of a new kind of [music] fight, and the people doing it aren't rival labs or bad actors. They're illustrators, photographers, creatives, and ordinary users with a free app, and they all have a reason to be furious. But, before we go any further, imagine this. You're online every single day. You check your email, open a few apps, look things up, stream videos, maybe even do all of that while traveling. And to you, that feels totally normal. But, behind the scenes, your internet provider, advertisers, network admins, and sometimes even governments can build a surprisingly detailed picture of what you're doing online. Now, to be clear, no VPN can protect you from everything. You still have to be smart online. Don't click suspicious links. Don't hand over personal information to sketchy emails. And definitely don't trust the so-called [music] Prince of Nigeria. But, a good VPN is an important layer of privacy because privacy shouldn't be something you only think about after something goes wrong. It should be the default. And that's exactly what ProtonVPN is built for. [music] ProtonVPN helps keep your browsing private wherever you are, whether you're at home, traveling, or just trying to stop your online activity from being tracked. Their no-logs policy has been verified by independent auditors, and Proton [music] is backed by a foundation dedicated to privacy, transparency, and user rights. ProtonVPN is also fully open source, meaning its code is publicly available for inspection. So, instead of [music] just asking you to trust them, Proton gives people a way to verify what they're doing. And privacy doesn't have to mean slow. Proton VPN offers high-speed connections with VPN accelerator plus Netshield, which blocks malicious ads and trackers before they ruin your browsing experience. It also gives you more freedom online. You can connect through servers around the world, access [music] content more securely while traveling, and use it for streaming, gaming, and P2P file sharing, all while keeping your online activity more private. So, whether you're trying to stop advertisers from following you, keep your browsing [music] private from your ISP, or just take back control of your online life, Proton VPN makes privacy simple. Click the link in the description or go to protonvpn.com/theinfographicshow to get up to a 70% discount when you sign up to Proton VPN's 2-year plan. Nobody poisons their own work for fun. They do it because they felt like their work was taken from them. That feeling doesn't come from nowhere. It all started with a theft. For years, the firms building these models treated the open web as a warehouse. They scraped billions of images, voices, and paragraphs from it. The original creators were never asked, and they were never paid. It was a heist, plain and simple. Much of that haul went into one open data set called LAION 5B, which held a massive data set made up of 6 billion images and accompanying text. Stable Diffusion learned from it, and so did most of the art that followed. It was a compressed version of the visible internet folded into something machines learn from. Then the artists started paying attention. [music] They started recognizing their own work in the output. Styles and techniques that took decades to develop were being reproduced in seconds. [music] By 2023, a generator could mimic the brushstrokes and the talent of an artist in a heartbeat. A career's worth of experience was reduced to a prompt [music] and undercut by a tool that cost nothing to use. Conceptual artist Karla Ortiz, along with other artists, sued Stability AI in 2023. Getty Images filed its own case around the same time. The lawsuits dragged [music] out, and all the while the scraping continued and the models improved. The companies behind the models freely admitted to their practices. Open AI told the British Parliament that building today's top models without copyrighted work would be impossible. Sure, there were opt-out forms, but [music] it put the onus on the creator instead of asking permission up front. Artists had to hunt [music] down the models, file requests one by one, and then hope they were honored. The balance of power remained with the developers. So, the artists adapted. Ordinary uploads turned into weapons one file at a time. In 2023, the University of Chicago released a program called Glaze, and it was aimed directly at the AI models. Type in an artist's name into an AI model, and it'll generate a painting based on that particular style and the data it's learned on. Glaze [music] changes that. It works by exploiting how a computer sees an image. To an AI, a painting isn't really a painting at all. It's a series of numbers that make up the style and structure. Glaze distorts the numbers slightly. It's subtle, something that isn't visible to the human eye, but the machine learns from the cloaked information. It works like an optical illusion. Two viewers can look at [music] the same image and see completely different things. In this case, the viewers are you and the machine. You see your painting exactly as was intended. The model sees something else. An oil painting might seem like it's in charcoal. A watercolor might be seen as completely different medium. The visual style that the scraper came to learn from has effectively been moved. Word spread [music] fast, and Glaze is now past 6 million downloads, but there are limits. Glaze [music] could hide a style, but it couldn't stop someone from taking the image itself. And every time people found a new way to alter the image, scrapers came back with better ways to recover it. It was like playing defense forever. The creators needed something that could end the fight. They needed a poison pill. It came in January 2024, and it was Nightshade. Another product from the University of Chicago, it had one goal: to infect. An image run through Nightshade will look completely normal to both human eyes and the machine. But, it's like a Trojan [music] horse. If a machine is trained on that one image, the model starts learning nonsense. The results are almost comical. Hats turn into cakes, handbags into toasters, and the cars learn to be drawn as a cow. For artists and creators, it felt like payback. For years, AI companies had scraped artwork to train their models. Now, the very thing being taken could be turned against the people taking it. The demand was instant. Nightshade hit 250,000 downloads in just 5 days. University servers buckled under the traffic. The team behind it had to scramble to post backup download links as thousands more rushed to get it. Most people assumed this was a form of hacking. It's not. No firewall gets breached and the tool never touches a single company server. Researchers call it adversarial machine learning. But, a simpler way to look at it is that Nightshade is a magic trick for the machines. The model isn't attacked from the [music] outside. It is fooled into teaching itself the wrong thing, and then it trusts that mistake as if it were true. It doesn't take much to start the process. Fewer than 100 carefully crafted images can be enough to poison a single concept inside a top AI model. And if you pair Nightshade with Glaze, that same image can hide an artist's style and poison the training data at the same time. But, those results came from models researchers could test directly. The bigger AI systems are harder to study, and nobody outside those companies knows exactly how vulnerable they are. But, that is not really the point. Nightshade took the idea from a theory on paper to something that actually worked. The damage doesn't stay contained, either. Poison the concept of a dog and the related ideas like huskies, puppies, and wolves can start drifting with it. In some tests, researchers fed hundreds of corrupted images in a single model until it could barely generate recognizable images at all. And that's where this stopped being purely defensive. Every poisoned image uploaded to the internet becomes a potential sleeper cell. It can remain unnoticed inside a data set for months or years, waiting for the next training run. The person who uploaded it might never even know if it was collected or which model eventually learned from it. Images were only the start. The same trick works on anything a machine learns from, from your writing to your face, and your voice is the next target. A service like 11 Labs needs only a few clean sounds of your voice to build a convincing copy. A podcast clip can be enough. So can a YouTube video, a few seconds of footage on social media, or even an old voicemail buried in someone's phone. It's become a favorite tool of scammers, and it isn't a hypothetical risk. In 2024, criminals used cloned voices and faces to steal about $25 million in a single fake video call. Banks and law enforcement agencies now warn people about calls from cloned relatives asking for money. A tool called Safe Speech was built by security researchers for this exact reason. Your voice has its own signature, a kind of audio fingerprint that AI systems use to recognize and copy you. Safe Speech subtly smudges that fingerprint. To another person, you sound exactly the same, but to a voice cloning model, you become much harder to copy. To the machine, it works a bit like radio interference. You hear the voice clearly, but the AI doesn't. The details it needs most get scrambled. Train a voice clone on bad recording, and the results come out wrong. They're close enough to sound human, but missing the subtle traits that make you sound like you. The timing is what makes it clever. This isn't a filter slapped onto a fake after it's generated. It's in the original recording itself. The AI learns from the protected version, which means the cloning process breaks before it ever succeeds. There is no clean copy for the model to learn from. That's what makes this different from protecting artwork. A stolen portfolio is one kind of loss. Your voice is another. It's the sound your family and friends recognize instantly, the thing a scammer wants the most when they're trying to impersonate you. It turns the tables. The target gets to set the trap. For For first time, artists, writers, and everyday people had a way to fight back against systems trained on their work and identities. It sounded like the next step in digital security. And then, the AI labs responded. They weren't about to lose access to the data that fueled their models. If artists [music] could poison the training set, the labs would try to remove the poison. And that kicked off something bigger than a security tool, an arms race. They couldn't [music] just accept corrupted data sets, and they couldn't afford to throw most of them away, either. So, they tried a straightforward fix. They [music] began checking each scraped image against its caption. And then, they dropped anything that didn't match. In theory, poisoned data should stand out. In reality, it only catches part of it. Tests on these systems show it flags maybe 40 to 60% of poisoned images. >> [music] >> The rest slips through. And then, there's a second problem. It also deletes plenty of clean data, leaving the model with either contaminated data or not enough to learn from. So, they tried something else. They started scrubbing every image through a cleaning model before training, trying to wash out anything suspicious. It sounds clever, but it's slow and expensive. And [music] it still has limitations, because the poisoning adapts. Artists design it to survive that cleaning step, [music] so it reappears on the other side like a stain bleeding back through. Not long after Glaze launched, one research group said it had already broken through the cloaking. So, the Chicago team pushed out a tougher version. Whenever the program was breached, they developed a new patch. It was a war of attrition. Even if a voice has protection built in, there are still ways to strip parts out of it. Push it through enough processing, and some of that protection starts to fade. In some cases, it gets noticeably weaker. Not gone, but damaged enough to matter. The poisoners are winning for now, and the reason is lopsided. You have small teams constantly trying new tricks in the open. On the other hand, a handful of AI labs are trying to patch holes as they appear. So, every time a lab rolls out a fix, it gets tested immediately, and almost immediately a new version shows up, adjusted just enough to get around it, usually within weeks. And this all comes with a price tag. It doesn't land on the labs first, it lands on the people training the models with the data. The whole AI business model was built on the promise that the data would be free, endless, and clean. The poison breaks the idea of clean. Once that goes, the other two stop feeling true as well, because now nothing can be trusted at face value. A poisoned file looks identical to a real one. There's no label or warning, so every data set turns into something that has to be checked manually or with tools that still miss a lot. Training a top model already costs hundreds of millions of dollars, and every extra cleanup step adds to that bill. A single poisoned batch can set a project back by weeks, and that's the point. The goal was never to wreck one model for fun. It was to make [music] stolen data more expensive than paid data. There's already a legal cleaner method being used. Adobe trained its Firefly tool on Midjourney images, Shutterstock on similar deals. If you want clean, quality data, you need to pay for it. That is a serious problem for the industry. Investors [music] poured tens of billions into AI on a single bet that the data would stay cheap forever. That bet isn't looking like a sure thing anymore. For a long time, the belief was that if you created something, you own it. The scrapers tore that deal up without asking anyone. The AI companies act as if human work was free, endless, and owned by no one. That was the original mistake. Paintings were scraped, photos were downloaded, voices, faces, videos were collected in huge amounts. If it was online, it was fair [music] game. Consent seemed optional. In every other industry, the opposite is the standard. A photographer licenses an image before a brand uses it. Musicians clear samples before a track goes live. Even film studios pay for every frame of stock footage they use. The work of millions of people got treated as if it belonged to no one. This battle wasn't created by the artists. It was the AI labs and their trainers. The moment work was taken without asking, the balance changed. Everything after that was just a reaction. You can't build an empire on the idea that people do not count [music] and then act shocked when those same people fight back and question how the system works. Because the problem isn't sitting in a contract or on a policy page, it's built into the way the models learn in the first place. Every safeguard before this tried to politely control behavior through copyright notices or opt-out [music] forms, but none of it really stopped the scraping. This is different. For the first time, a single person can influence what the system learns next and the system doesn't get to ignore it. With people turning the tables on AI scrapers, digital theft is getting harder, especially when it comes to scams. But this isn't the first time people have had to push back. Watch Time Scammers [music] Messed With the Wrong People to find out what happens when karma is dished out or click on this video.